An Advanced Persistent Threats Detection Method Based on Deep Reinforcement Learning

Abstract

AbstractAn advanced persistent threat (APT) is a stealthy cyber attack which can have the ability to illegally enter a system and remain undiscovered for a long time. Dynamic information flow tracking is one of the leading methods to detecting advanced persistent threats, which can taint suspicious information flows and generate security analysis for abnormal and questionable use of the information flow. In this paper, we develop a novel model to detect APTs. We build a zero-sum, two-player, asymmetric information Markov game. Because the DIFT cannot distinguish between normal and malicious information flow, the defender has less state information than the attacker. We analyzed the existence of the Nash equilibrium of our game. Finally, we used Neural Fictitious Self-play (NFSP), the leading algorithm for zero-sum games in Deep Reinforcement Learning, to solve the Nash equilibrium for this game.KeywordsAdvanced Persistent Threats (APTs)Neural Fictitious Self-PlayDeep reinforcement learningInformation flow tracking